Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Games

Breach intelligence, attack campaigns, and threat reports targeting the Computer Games sector.

77 threat reports
Page 1 of 7
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Games Threat Reports

Showing 1–12 / 77 reports
NIKKE Launcher Breach 2026: How CDN Script Tampering Turned 45 Million Players Into Malware Targets
NIKKE Launcher Breach 2026: How CDN Script Tampering Turned 45 Million Players Into Malware Targets
Computer Games4 days ago

NIKKE Launcher Breach 2026: How CDN Script Tampering Turned 45 Million Players Into Malware Targets

In late September 2026, threat actors compromised four JavaScript files hosted on Level Infinite's official CDN that powered the PC launcher for the popular mobile-and-PC RPG Goddess of Victory: NIKKE, which has surpassed 45 million downloads since 2022. The tampered scripts—undetected for roughly five weeks—silently downloaded obfuscated code from attacker-controlled domains (insightjs[.]com / insightjs[.]org) and deployed a LuaJIT backdoor known as K2F. The backdoor enabled remote command execution, file exfiltration, screenshot capture, NIKKE credential harvesting, and browser-stored data theft. A secondary Windows DLL (platform_experience_helper.dll) targeted cryptocurrency wallet extensions including MetaMask, Phantom, and Coinbase Wallet. Level Infinite acknowledged the tampering on November 4, 2026 and issued an emergency client update. This incident exemplifies the accelerating threat of CDN and build-pipeline supply-chain attacks, where a single poisoned distribution point can silently weaponize a trusted software update for millions of end users. As gaming platforms expand their payment and crypto-wallet integrations, they become high-value targets for financially motivated actors blending infostealer and RAT capabilities into a single stealthy implant.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
MALFEX Supply Chain Attack: How 40K+ npm Downloads Delivered Overlord RAT
MALFEX Supply Chain Attack: How 40K+ npm Downloads Delivered Overlord RAT
Computer Software/Engineering1 month ago

MALFEX Supply Chain Attack: How 40K+ npm Downloads Delivered Overlord RAT

The MALFEX campaign represents a sophisticated npm supply chain attack that has been active since August 2023, with threat actors publishing 12 packages and compromising over 40,000 downloads. Eight malicious packages were designed to deploy the Overlord RAT and custom Node.js stealers targeting Discord, browsers, Telegram, and cryptocurrency wallets on Windows systems. The Portuguese-speaking threat actor, identified as 'Murizada,' used lifecycle hooks and dependency chains to execute malicious payloads, with the 'function-flag' package alone accounting for 37,419 downloads. The campaign demonstrates advanced supply chain manipulation techniques and has expanded beyond npm to include WordPress exploits and macOS targeting. This incident highlights the growing sophistication of supply chain attacks targeting developer ecosystems, with threat actors increasingly leveraging trusted package repositories to distribute malware at scale. The campaign's longevity and evolution across multiple platforms signals a concerning trend in how adversaries are adapting their tactics to exploit the expanding attack surface of modern development workflows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PhantomSub Campaign Exposes Critical Gap in Package Repository Security
PhantomSub Campaign Exposes Critical Gap in Package Repository Security
Computer Software/Engineering1 month ago

PhantomSub Campaign Exposes Critical Gap in Package Repository Security

In September 2026, cybersecurity researchers discovered the PhantomSub campaign involving 101 malicious npm packages that collectively garnered 490,000 downloads. These packages, masquerading as legitimate Baileys WhatsApp API libraries, automatically subscribed developers' WhatsApp accounts to spam groups without consent. The campaign targeted developers building WhatsApp bots, with attackers primarily monetizing through Indonesian mobile game account sales and bot-building services. The malware operated through three variants with different obfuscation techniques, all designed to add victims to attacker-controlled channels for commercial gain. This incident highlights the growing sophistication of supply chain attacks targeting open-source ecosystems, particularly as developers increasingly rely on third-party packages for messaging and automation features. The campaign's success demonstrates how attackers exploit trust in popular libraries to achieve social engineering objectives beyond traditional data theft.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Gyazo Breach Exposes 23.6 Million Users: Server Vulnerability Leads to Massive Data Theft
Gyazo Breach Exposes 23.6 Million Users: Server Vulnerability Leads to Massive Data Theft
Computer Games1 month ago

Gyazo Breach Exposes 23.6 Million Users: Server Vulnerability Leads to Massive Data Theft

On September 11, 2026, attackers exploited a server vulnerability in Gyazo's image-sharing platform to steal 23.6 million user records and 490 million image metadata entries. The breach exposed names, email addresses, password hashes, session IDs, and private image metadata including EXIF location data and OCR-extracted text. Gyazo detected the intrusion on September 12 and took the platform offline for maintenance, but the damage was already done with attackers potentially accessing private images and sensitive user information. This incident highlights the growing trend of attackers targeting cloud-based media platforms and the critical importance of server hardening as organizations increasingly rely on image-sharing services for business communications and collaboration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
FBI Dismantles NightmareStresser: The Rise and Fall of a Major DDoS Empire
Computer Games1 month ago

FBI Dismantles NightmareStresser: The Rise and Fall of a Major DDoS Empire

On September 17, 2026, the FBI seized the NightmareStresser DDoS-for-hire platform, one of the world's longest-running booter services that enabled cybercriminals to launch massive distributed denial-of-service attacks. The platform, operating through nightmare-stresser.com and nightmarestresser.org domains, boasted over 566,000 registered users and 52 dedicated servers capable of generating attacks up to 200 Gbps. Since 2022, NightmareStresser facilitated hundreds of thousands of DDoS attacks targeting victims worldwide, leveraging compromised IoT devices and routers as attack infrastructure. This seizure highlights the escalating threat of commoditized DDoS services that democratize cyberattacks, enabling even non-technical actors to launch sophisticated infrastructure attacks. The continued evolution of booter services represents a persistent challenge to organizations' availability and business continuity, particularly as these platforms increasingly target critical infrastructure and essential services.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
NightmareStresser Takedown: How US Authorities Disrupted a Massive DDoS Empire
NightmareStresser Takedown: How US Authorities Disrupted a Massive DDoS Empire
Higher Education/Acadamia1 month ago

NightmareStresser Takedown: How US Authorities Disrupted a Massive DDoS Empire

In September 2026, the U.S. Department of Justice seized two domains associated with NightmareStresser, a distributed denial-of-service (DDoS)-for-hire service that facilitated hundreds of thousands of attacks since 2022. The platform operated with over 566,000 registered users across 52 servers, targeting educational institutions, government agencies, gaming platforms, and millions of individuals worldwide. The service offered advanced Layer 4 and Layer 7 attack capabilities, cryptocurrency payment options, and claimed 24/7 availability over eight years of operation. This seizure represents a critical escalation in the ongoing battle against cybercrime-as-a-service platforms, highlighting the urgent need for organizations to implement comprehensive DDoS protection and network security measures as these attacks continue to evolve in sophistication and scale.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
FBI Disrupts NightmareStresser: Major DDoS-for-Hire Takedown Exposes Cybercrime-as-a-Service Threats
FBI Disrupts NightmareStresser: Major DDoS-for-Hire Takedown Exposes Cybercrime-as-a-Service Threats
Computer Games1 month ago

FBI Disrupts NightmareStresser: Major DDoS-for-Hire Takedown Exposes Cybercrime-as-a-Service Threats

In December 2024, the FBI and Royal Canadian Mounted Police seized the primary domain and associated websites of NightmareStresser, one of the longest-running and most popular DDoS-for-hire services used by cybercriminals globally. Operating since at least 2022, the service facilitated hundreds of thousands of DDoS attacks against educational institutions, government agencies, gaming platforms, and millions of individuals worldwide. The takedown was part of Operation PowerOFF, an ongoing international effort targeting IP stressers and booter services that make DDoS attacks accessible to non-technical users through user-friendly interfaces and tutorials. This incident highlights the persistent threat of commoditized cyber attack services that democratize sophisticated attack capabilities, enabling script kiddies and low-skilled threat actors to launch disruptive campaigns against critical infrastructure and services with minimal technical expertise required.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Google Play Early Access Exploited: How Thousands of Deceptive Apps Bypassed Security
Google Play Early Access Exploited: How Thousands of Deceptive Apps Bypassed Security
Computer Games1 month ago

Google Play Early Access Exploited: How Thousands of Deceptive Apps Bypassed Security

In September 2026, cybersecurity researchers discovered threat actors systematically abusing Google Play's Early Access program to distribute thousands of deceptive Android applications. These malicious apps promised financial rewards, casino winnings, and premium content while exploiting the program's feature that prevents user reviews and ratings. Notable examples included fake casino games and a Grand Theft Auto imitator called "Vice Streets: Open World" with over 1 million downloads. The attackers promoted these apps through social media platforms using AI-generated celebrity deepfakes, ultimately generating revenue through excessive advertising while never delivering promised payouts to users. This incident highlights the growing sophistication of mobile malware campaigns that exploit legitimate platform features to bypass traditional security mechanisms. The abuse of Early Access programs represents an emerging trend where attackers leverage regulatory gaps and user trust mechanisms to distribute deceptive applications at scale.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Inside CL-CRI-1171: The Massive Pay-Per-Install Network That Hid in Plain Sight
Inside CL-CRI-1171: The Massive Pay-Per-Install Network That Hid in Plain Sight
Computer Games2 months ago

Inside CL-CRI-1171: The Massive Pay-Per-Install Network That Hid in Plain Sight

In September 2026, Unit 42 researchers uncovered CL-CRI-1171, a sophisticated pay-per-install (PPI) malware distribution network that operated undetected for over two years. The cybercrime group leveraged YouTube gaming channels with hundreds of thousands of followers and SEO poisoning techniques to distribute multiple malware families including Insomnia RAT, ARKTunnel, and Docro Hijacker. The operation used OfferLoader, a custom Inno Setup-based loader, to deploy over 10,000 distinct payload combinations across corporate networks, critical infrastructure, and government entities while evading detection through clever gating mechanisms and unremarkable appearance. This campaign highlights the growing threat of commodity infrastructure being weaponized for large-scale malware distribution, particularly as threat actors increasingly target younger demographics through gaming platforms and use legitimate-seeming tools to bypass security scrutiny.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
REVSTEALER's Four-Module Attack: How Infostealers Are Evolving Beyond Credential Theft
REVSTEALER's Four-Module Attack: How Infostealers Are Evolving Beyond Credential Theft
Computer Games2 months ago

REVSTEALER's Four-Module Attack: How Infostealers Are Evolving Beyond Credential Theft

In September 2026, Elastic Security Labs documented four previously unreported modules associated with REVSTEALER, a commercial Windows information stealer active since February 2026. The malware initially operates as a traditional infostealer, harvesting browser credentials, cryptocurrency wallets, gaming accounts, and messaging data before deleting itself. However, four persistent modules remain on infected systems: ProManager (wallet overlay attacks), WinUpdate (clipboard cryptocurrency address replacement), SoftManager (reverse proxy), and LockAppHost (disables Windows Update and Defender to run cryptocurrency miners). The malware spreads primarily through game cheat lures on compromised YouTube channels and fake AI applications. This incident highlights the evolution of infostealers beyond simple credential theft toward persistent system compromise and resource abuse. As threat actors increasingly combine multiple attack vectors in single campaigns, organizations face compound risks from credential harvesting, system weakening, and unauthorized resource consumption that can persist long after the initial infection appears resolved.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CyberLeek's GTA VI Data Theft: How Gaming's Biggest Leak Redefined Cyber Extortion
Entertainment/Movie Production2 months ago

CyberLeek's GTA VI Data Theft: How Gaming's Biggest Leak Redefined Cyber Extortion

In late 2024, threat actor 'CyberLeek' launched a sophisticated data theft and extortion campaign against Rockstar Games, leaking pre-release gameplay footage from the highly anticipated Grand Theft Auto VI game. The attacker published proprietary content across multiple platforms including Discord, demonstrating either insider access or a significant breach of Rockstar's development systems. The incident caused substantial reputational damage and prompted aggressive legal action from Take-Two Interactive, including federal subpoenas against Discord, Google, Microsoft, and X to identify the perpetrators. The attack employed a novel monetization strategy, combining cryptocurrency schemes with watermarked stolen content and crowdsourced pressure tactics to maximize financial gain from the leaked intellectual property. This incident represents an evolution in data extortion tactics, where threat actors leverage public anticipation and social media amplification to maximize pressure on victims. The attack demonstrates how modern cybercriminals are adapting traditional ransomware playbooks to target high-value intellectual property in the entertainment industry, creating new challenges for incident response and legal remediation.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Weedhack Malware Campaign Exploits Minecraft Community Through Advanced SEO Manipulation
Computer Games2 months ago

Weedhack Malware Campaign Exploits Minecraft Community Through Advanced SEO Manipulation

In August 2026, cybersecurity researchers discovered that the Weedhack malware family continues to actively target Minecraft gamers through sophisticated SEO poisoning campaigns and fake gaming websites. The attackers created convincing replicas of legitimate Minecraft clients and tools, using platforms like Discord, MediaFire, and GitHub to distribute malicious JAR files. McAfee Labs detected over 6,300 attempts to access these malicious sites, which successfully outranked legitimate sources in search engine results. The malware establishes persistence by disabling Microsoft Defender, stealing sensitive data, and maintaining command and control communications. This incident highlights the growing sophistication of gaming-focused malware campaigns and the increasing use of AI-powered tools to create convincing fake websites. The success of these SEO poisoning techniques demonstrates how threat actors are adapting their distribution methods to exploit trusted platforms and search engine algorithms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports